When consent purposes or third parties change, existing consent is invalidated

GDPR Art. 7(3) and Art. 13(3) require fresh consent whenever the purposes or conditions of processing change materially. A user who consented to analytics-only cookies in January did not consent to session recording you added in March. If the stored consent record has no version, your application cannot distinguish old consent from new consent — and will treat the January acceptance as valid for the March tracking, which it is not. This is a silent compliance gap: nothing breaks, but every user who visited before your tracking expansion is being processed without valid consent for the new purposes.

Implement versioned consent checks that re-show the banner when the stored version does not match the current consent notice version. Bump the version every time new tracking tools or purposes are added.

// lib/consent.ts
export const CURRENT_CONSENT_VERSION = '2026-02-01'
// Increment this date each time you add new tracking tools or purposes

export function hasValidConsent(): boolean {
  const stored = localStorage.getItem('gdpr_consent_v1')
  if (!stored) return false
  const record = JSON.parse(stored) as { consentVersion?: string }
  if (record.consentVersion !== CURRENT_CONSENT_VERSION) {
    localStorage.removeItem('gdpr_consent_v1')  // invalidate outdated consent
    return false
  }
  return true
}

// In ConsentBanner useEffect:
// useEffect(() => { if (!hasValidConsent()) setVisible(true) }, [])

Maintain a changelog of consent notice versions in docs/consent-changelog.md: "2026-02-01: Added Hotjar session recording". Each entry requires a version bump and re-consent for all users.